---
id: "2026-10-17-opencode-console-breach-provider-keys"
url: "https://postcutoff.com/e/2026-10-17-opencode-console-breach-provider-keys/"
as_of: "2026-10-18T02:22:00+02:00"
date: "2026-10-17"
date_precision: day
category: policy-safety
importance: 3
confidence: medium
status: [Partly confirmed]
sources: 3
editor: human editor
human_review: null
version: null
---

As of: 2026-10-18 02:22 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code), with a human editor. How we work: https://postcutoff.com/about/
Canonical page: https://postcutoff.com/e/2026-10-17-opencode-console-breach-provider-keys/

# OpenCode breach leaks stored provider API keys

Full title: OpenCode Console breach exposes users' stored OpenAI, Anthropic and Google API keys in what the company calls a 'large scale distillation attack'

On Oct 17, 2026 OpenCode (made by Anomaly Innovations) said a breach "related to a large scale distillation attack" hit about 1.4% of OpenCode Console users: those who had linked external providers, whose stored OpenAI, Anthropic and Google API keys were exposed. The company is working with the three labs; Anthropic said it revoked Claude API keys it believed were affected. It is one of the first reported cases of a coding-agent service leaking frontier-model keys, apparently to obtain tokens for distillation.

## Key facts
- OpenCode on X (Oct 17, 18:08 UTC, ~903k views): breach from 'a large scale distillation attack that impacted 1.4% of OpenCode Console users'; affected users emailed; only users with linked external providers affected; incident 'ongoing'; working with Anthropic, OpenAI and Google
- Exposed: OpenAI, Anthropic and Google API keys saved in users' Console workspaces, from a 'legacy system' being shut down (per the company notice as reported by Startup Fortune)
- Company: no evidence 'to date' that other data leaked; cannot confirm whether keys were used maliciously; advises revoking and reissuing keys in each provider's dashboard, checking usage from Oct 17 and setting spending limits
- Anthropic's Lydia Hallie (Claude Code team, Oct 17): Anthropic worked with OpenCode and 'revoked Claude API keys we believe were affected'
- Unverified user reports on X: unauthorized charges 'in the hundreds of dollars', a suspended Google Cloud project, an OpenAI account deleted for terms violations
- Open questions: how attackers got in, how many accounts 1.4% is, and why it is called a distillation attack (commentators incl. Nathan Lambert asked whether it means stolen keys used to harvest model outputs)

## What happened

OpenCode, the open-source coding agent built by Anomaly Innovations, emailed affected users on Oct 17 and posted on X that a breach
tied to "a large scale distillation attack" had hit about 1.4% of OpenCode Console users. Only users who had linked external
model providers were affected; their stored provider API keys (OpenAI, Anthropic, Google) were exposed. The company said the
incident was ongoing and that it was working with the three labs. Anthropic's Lydia Hallie said Anthropic had revoked the Claude API
keys it believed were affected. Startup Fortune reported that the keys came from a legacy system being shut down and that some users
reported unauthorized charges; those reports are unverified.

The company did not explain the "distillation" label. A plausible reading, not confirmed by OpenCode, is that the attackers wanted
other people's keys to pull large volumes of frontier-model outputs for training their own models while hiding behind many accounts.

## Why it matters

Labs have described distillation campaigns run through fake or resold accounts (see Anthropic's reports). This incident points to a
different supply route: stolen keys from third-party agent tools, where users pay the bill. It also shows the risk of storing frontier
API keys in hosted consoles of agent tools.

## Your AI and this story

- GPT-6 Astra (training cutoff April 2026): 170 days after its cutoff
- Claude Opus 5.5 (training cutoff June 2026): 109 days after its cutoff
- Gemini 4 Argon (training cutoff March 2026): 200 days after its cutoff
- Grok 4.7 (training cutoff May 2026): 139 days after its cutoff

## Sources

1. [OpenCode on X: breach notice (Oct 17)](https://x.com/opencode/status/2111519637049319818) (x.com, official)
2. [Startup Fortune: OpenCode breach exposes stored OpenAI and Anthropic keys, prompts urgent key rotation](https://startupfortune.com/opencode-breach-exposes-stored-openai-and-anthropic-keys-prompts-urgent-key-rotation/) (startupfortune.com, press)
3. [Lydia Hallie (Anthropic) on X: Claude API keys revoked](https://x.com/lydiahallie/status/2111563956666110287) (x.com, discussion)

## Changes

- 2026-10-18 (filed): Created (OpenCode and Hallie posts read via fxtwitter; Startup Fortune)

## Related

- 2026-10-12: [Anthropic says new defenses cut the Claude reasoning harvested by distillers by about 90 to 99 percent](https://postcutoff.com/e/2026-10-12-anthropic-distillation-defenses/index.md)
- 2026-02-23: [Anthropic accuses DeepSeek, Moonshot and MiniMax of 'distillation attacks'](https://postcutoff.com/e/2026-02-23-anthropic-distillation-attacks-report/index.md)
- People: [Nathan Lambert](https://postcutoff.com/person/nathan-lambert/)
- Archived: 2 posts, listed in https://postcutoff.com/e/2026-10-17-opencode-console-breach-provider-keys/index.json